> ## Documentation Index
> Fetch the complete documentation index at: https://www.dynamic.xyz/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies

> Apply account-wide, wallet, and signer policy rules to business-account wallets.

<Note>
  Business Accounts are in **early access**. See the [overview](/docs/javascript/reference/business-accounts/overview) for the model.
</Note>

Business-account wallets use Dynamic's policy composition feature. Rules are evaluated in layers, from the broadest to the narrowest: [environment](/docs/overview/wallets/embedded-wallets/mpc/policies/creating-rules), account, wallet, signer. A transaction must pass every layer.

For how to set environment-wide rules, see [Creating & Managing Rules](/docs/overview/wallets/embedded-wallets/mpc/policies/creating-rules) in the general [Policies & Rules](/docs/overview/wallets/embedded-wallets/mpc/policies/overview) guide.

* **Account-Layer**: one policy that applies to every wallet in the business account. Only a business-account owner or admin can edit it.
* **Wallet-Layer**: rules for a specific wallet. On a business-account wallet, only a business-account owner or admin can edit it.
* **Signer-Layer**: rules for an individual signer. A signer can edit their own layer; a business-account owner or admin can edit any signer's layer.

For the rule types and security model, see [Policies & Rules](/docs/overview/wallets/embedded-wallets/mpc/policies/overview).

## JavaScript SDK helpers

For account, wallet, and signer layers, the JavaScript SDK provides sugar helpers that work with a `PolicyRules` map. They handle rule IDs and batch updates for you.

```js theme={"system"}
import {
  createPolicy,
  getPolicy,
  removePolicyRules,
} from '@dynamic-labs-sdk/client/waas';
```

### Account-Layer

Use `scope: { businessAccountId }` to apply rules to every wallet in the business account.

```js theme={"system"}
const businessAccountId = businessAccount.id;

// Set or replace account-wide rules
const layer = await createPolicy({
  scope: { businessAccountId },
  chain: 'EVM',
  chainIds: [1],
  rules: {
    allowAddresses: ['0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'],
    maxPerTransaction: { amount: '100000000000' },
  },
});

// Read the account-Layer back into the sugar map
const { rules, layerId, updatedAt } = await getPolicy({
  scope: { businessAccountId },
});

// Remove account-wide rules by their sugar keys
await removePolicyRules({
  scope: { businessAccountId },
  chain: 'EVM',
  chainIds: [1],
  rules: ['maxPerTransaction'],
});
```

### Wallet-Layer

Use `scope: { walletId }`, where `walletId` is the wallet's `verifiedCredentialId`.

```js theme={"system"}
const walletId = walletAccount.verifiedCredentialId;

// Set or replace rules by key
const layer = await createPolicy({
  scope: { walletId },
  chain: 'EVM',
  chainIds: [1],
  rules: {
    allowAddresses: ['0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48'],
    maxPerTransaction: { amount: '100000000000' },
  },
});

// Read the layer back into the sugar map
const { rules, layerId, updatedAt } = await getPolicy({
  scope: { walletId },
});
// rules.allowAddresses, rules.maxPerTransaction, etc.

// Remove rules by their sugar keys
await removePolicyRules({
  scope: { walletId },
  chain: 'EVM',
  chainIds: [1],
  rules: ['maxPerTransaction'],
});
```

### Signer-Layer

Use `scope: { walletId, shareSetId }` to target a specific signer. For the caller's own signer, `scope: { shareSetId }` also works if the wallet account is in the client's state.

```js theme={"system"}
// Set or replace signer rules
const layer = await createPolicy({
  scope: { walletId, shareSetId },
  chain: 'EVM',
  chainIds: [1],
  rules: { denyAddresses: ['0x...'] },
});

// Read signer rules
const { rules } = await getPolicy({
  scope: { walletId, shareSetId },
});

// Remove signer rules by key
await removePolicyRules({
  scope: { walletId, shareSetId },
  chain: 'EVM',
  chainIds: [1],
  rules: ['denyAddresses'],
});
```

## Rule fields

A `WaasPolicyRule` has the following fields:

| Field                               | Description                                                  |
| ----------------------------------- | ------------------------------------------------------------ |
| `name`                              | Human-readable rule name.                                    |
| `ruleType`                          | `allow` or `deny`.                                           |
| `chain`                             | Chain the rule applies to, e.g. `EVM`, `SOL`, `BTC`.         |
| `chainIds`                          | Array of chain IDs the rule applies to.                      |
| `addresses`                         | Array of addresses the rule applies to.                      |
| `valueLimit.maxPerCall`             | Maximum value per transaction, in the asset's smallest unit. |
| `operationRestrictions.blockExport` | When `true` on a `deny` rule, blocks private key export.     |

For allowlist semantics, address evaluation, and value limits, see [Policies & Rules](/docs/overview/wallets/embedded-wallets/mpc/policies/overview).

## Next steps

<CardGroup cols={2}>
  <Card title="Manage signers" icon="key" href="/docs/javascript/reference/business-accounts/manage-signers">
    Add and remove signers on a business-account wallet.
  </Card>

  <Card title="Sign transactions" icon="signature" href="/docs/javascript/reference/business-accounts/signing">
    Sign with a business-account wallet.
  </Card>
</CardGroup>